Amazon Linux AMI : rpm (ALAS-2021-1521)

The version of rpm installed on the remote host is prior to 4.11.3-40.79. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1521 advisory. A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can...

Amazon Linux AMI : nspr, nss-softokn, nss-util (ALAS-2021-1522)

The version of nspr installed on the remote host is prior to 4.25.0-2.45. The version of nss-softokn installed on the remote host is prior to 3.53.1-6.46. The version of nss-util installed on the remote host is prior to 3.53.1-1.58. It is, therefore, affected by multiple vulnerabilities as...

Amazon Linux AMI : curl (ALAS-2021-1509)

The version of curl installed on the remote host is prior to 7.61.1-12.98. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1509 advisory. It was discovered that libcurl did not remove authentication credentials from URLs when automatically populating the...

Amazon Linux AMI : dhcp (ALAS-2021-1510)

The version of dhcp installed on the remote host is prior to 4.1.1-53.P1.29. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1510 advisory. A flaw was found in the Dynamic Host Configuration Protocol DHCP. There is a discrepancy between the code that handles...

Amazon Linux AMI : bind (ALAS-2021-1508)

The version of bind installed on the remote host is prior to 9.8.2-0.68.rc1.87. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1508 advisory. A flaw was found in bind. The way DNAME records are processed may trigger the same RRset to the ANSWER section to be added mo...

Amazon Linux AMI : httpd24 (ALAS-2021-1514)

The version of httpd24 installed on the remote host is prior to 2.4.48-1.92. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1514 advisory. A flaw was found in Apache httpd. The modproxywstunnel module tunnels non-upgraded connections. CVE-2019-17567 A flaw w...

Amazon Linux AMI : libX11 (ALAS-2021-1517)

The version of libX11 installed on the remote host is prior to 1.6.0-2.2.14. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1517 advisory. A missing validation flaw was found in libX11. This flaw allows an attacker to inject X11 protocol commands on X clients, and in...

Amazon Linux AMI : golang (ALAS-2021-1512)

The version of golang installed on the remote host is prior to 1.15.12-1.67. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1512 advisory. A vulnerability was found in net/http of the Go standard library when parsing very large HTTP header values, causing a crash and...

Amazon Linux AMI : postgresql92 (ALAS-2021-1519)

The version of postgresql92 installed on the remote host is prior to 9.2.24-3.67. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1519 advisory. A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFIN...

Amazon Linux AMI : glibc (ALAS-2021-1511)

The version of glibc installed on the remote host is prior to 2.17-322.181. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1511 advisory. A vulnerability was discovered in glibc where the LDPREFERMAP32BITEXEC environment variable is not ignored when running...

Amazon Linux AMI : kernel (ALAS-2021-1516)

The version of kernel installed on the remote host is prior to 4.14.238-125.421. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1516 advisory. 2024-04-25: CVE-2021-46938 was added to this advisory. A denial-of-service DoS flaw was identified in the Linux...

Important: kernel-livepatch-4.14.225-169.362

Issue Overview: A use-after-free flaw was found in hcisendacl in the bluetooth host controller interface HCI in Linux kernel, where a local attacker with an access rights could cause a denial of service problem on the system The issue results from the object hchan, freed in...

Important: mod_http2

Issue Overview: A null pointer de-reference was found in the way httpd handled specially crafted HTTP/2 request. A remote attacker could use this flaw to crash the httpd child process, causing temporary denial of service. CVE-2021-31618 Affected Packages: modhttp2 Note: This advisory is applicabl...

Medium: transfig

Issue Overview: An Out of Bounds flaw was found in fig2dev utility within transfig. An attacker could use this flaw and provide a crafted input to readobjects probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as...

Amazon Linux 2 : libxml2 (ALAS-2021-1677)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1677 advisory. There's a flaw in libxml2's xmllint. An attacker who is able to submit a crafted file to be processed by xmllint could...

Amazon Linux 2 : libwebp (ALAS-2021-1676)

The version of libwebp installed on the remote host is prior to 0.3.0-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1676 advisory. A flaw was found in libwebp. A heap-based buffer overflow was found in PutLE16. The highest threat from this vulnerabilit...

Amazon Linux 2 : kernel (ALAS-2021-1675)

The version of kernel installed on the remote host is prior to 4.14.232-177.418. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1675 advisory. A flaw was found in kernel/bpf/verifier.c in BPF in the Linux kernel. An incorrect limit is enforced for pointer arithmetic...

Amazon Linux 2 : gupnp (ALAS-2021-1673)

The version of gupnp installed on the remote host is prior to 1.0.2-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1673 advisory. A flaw was found in gupnp. DNS rebinding can occur when a victim's browser is used by a remote web server to trigger actions against...

Amazon Linux 2 : transfig (ALAS-2021-1682)

The version of transfig installed on the remote host is prior to 3.2.8a-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1682 advisory. An Out of Bounds flaw was found in fig2dev utility within transfig. An attacker could use this flaw and provide a crafted input t...

Amazon Linux 2 : samba (ALAS-2021-1680)

The version of samba installed on the remote host is prior to 4.10.16-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1680 advisory. A flaw was found in samba. The Samba smbd file server must map Windows group identities SIDs into unix group ids gids. The code th...